The vulnerability is an improper access control flaw in internal cluster endpoints of Idira Secrets Manager Self‑Hosted. A remote attacker who is already authenticated with standard node‑level credentials could exploit these endpoints to read secrets that were not meant to be accessible or to trigger a denial‑of‑service condition. The flaw aligns with CWE‑284, Unauthorized Access.

Affected vendors and products are CyberArk Software, a Palo Alto Networks Company. Conjur Enterprise deployments on Idira Secrets Manager versions 13.0 through 13.8.0, on Central Credential Provider (CCP) 14.0 through 14.2.5, on z/OS Credential Provider 14.0 through 14.2.5, and on Credential Provider (CP) 14.0 through 14.2.5 are impacted.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, so actual exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need valid node‑level authentication, but internal cluster endpoints are usually available when the system is online, making the attack vector plausible for a motivated actor. No public exploit has been reported, but the high rating warrants prompt remediation.